How to share a continuous- variable quantum secret by optical interferometry 
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We develop the theory of continuous-variable quantum secret sharing and propose its interfero- 
metric realization using passive and active optical elements. In the ideal case of infinite squeezing, a 
fidelity T of unity can be achieved with respect to reconstructing the quantum secret. We quantify 
the reduction in fidelity for the (2,3) threshold scheme due to finite squeezing and establish the 
condition for verifying that genuine quantum secret sharing has occurred. 
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I. INTRODUCTION 

Classical secret sharing (CSS) introduced by Shamir 
[EJ is an important primitive of protection of a secret 
classical information. It involves a dealer who distributes 
a secret amongst a group of n parties (players) in a way 
that prevents all unauthorized subsets of players (referred 
to as the adversary structure) from reconstructing this 
state and permits authorized subsets (referred to as the 
access structure) to successfully reconstruct the state. 

In quantum information theory, where the quantum 
state itself is a repository of information, protection of 
this state is of paramount importance. The quantum 
version of secret sharing (QSS) j| || Q will likely play 
a key role in protecting secret quantum information, 
e.g. in secure operations of distributed quantum compu- 
tation, sharing difficult-to-construct ancilla states and 
joint sharing of quantum money, as examples of the ver- 
satility of QSS pi. Other examples of quantum secu- 
rity include quantum key distribution B, protection of 
a classical secret by quantum means in the presence of 
eavesdroppers [|6| [7| , and quantum bit commitment g . 

Whereas quantum secret sharing has been developed 
for discrete variables P, 0, E| , here we develop continuous- 
variable (CV) quantum secret sharing and show how 
it can be implemented using optical interferometry and 
squeezed light sources ||. Both the theory and the pro- 
posed experimental realization are quite different from 
their discrete variable counterparts, yet serve the name 
goal: sharing secret quantum states. CV quantum infor- 
mation theory has achieved enormous success in quan- 
tum teleportation pi and quantum computation Jll| , 
and continuous-variable quantum secret sharing can be 
expected to play a key role in future integrated CV quan- 
tum information systems. The recent explosion of work 
going into linear optical quantum computation is an ex- 
ample of the importance of interferometric approaches to 
quantum information |12|| , and our proposal fits well with 
this rapidly growing subfield of quantum information re- 
search. 

We develop the (2, 2) threshold quantum secret sharing 
protocol for passive linear interferometry, and our proto- 
cols for higher threshold QSS schemes require squeezed 
light. We show that finite squeezing limits the fidelity 



of the reconstructed secret quantum state, and we es- 
tablish a lower bound on fidelity for the (2, 3) threshold 
scheme. This lower bound is a criterion for establishing 
that genuine QSS (as opposed to classical secret sharing) 
has been achieved. Finally we discuss the extension of 
our protocol to non-threshold QSS schemes. 

In contrast to the case of discrete- variable QSS |^, ||, Q, 
continuous-variable QSS involves states in infinite di- 
mensional Hilbert spaces. Quantum information the- 
ory in infinite dimensional Hilbert spaces is a feature of 
working with continuous variables pOl pT[. In the QSS 
scheme discussed here, the secret state ip from an infinite- 
dimensional Hilbert space TL is encoded into an entangled 
state $ € Tl® n as n shares, one for each player. The en- 
tanglement is designed so that entanglement swapping 
operations Eg ] by authorized groups of players can re- 
cover the secret state, and unauthorized groups recover 
no information whatsoever about the secret state. 



II. THRESHOLD SCHEMES 

We will consider first the threshold quantum secret 
sharing scheme for CV. Whereas secret sharing is con- 
cerned with general adversary and access structures, 
threshold secret sharing considers a particular access 
structure. For n players, the access structure for (fc,n) 
threshold secret sharing H is the set consisting of all 
groupings of k or more players, and the adversary struc- 
ture is the set of all groupings consisting of fewer than k 
players. We will discuss in detail the (k, 2k— 1) threshold 
scheme. The general (fc, n) scheme, with n < 2k — 1, can 
be achieved from (k, 2k— 1) scheme by having the dealer 
discard 2k — n—l shares prior to dealing the state <&, and 
threshold schemes with n > 2k are not possible due to the 
non-cloning theorem [g, [l4| . In the (fc, 2k — 1) threshold 
scheme, the dealer's state $ may be operated on by k col- 
laborators to produce the output state <I> ou t € Ti® 2k ~ l . 
Ideally, <J> out is a product of the original secret state ip 
and k — 1 pairwise entangled states, each in the Hilbert 
space Tti&Hj, where the i th and j th player is a collabora- 
tor and adversary (or non-collaborating player), respec- 
tively. This entanglement of states between collaborator 
and adversary ensures that adversaries do not acquire 



any information whatsoever about ip. 

We introduce a continuous-variable representation for 
the secret state \ip) as ip(x) — {x\tp) for \x) the eigenstate 
of the canonical position operator x, and the eigenvalue 
spectrum is x € R. The eigenstates of x are not normal- 
izable but satisfy the orthogonality relation 



(x'\x) = 8{x — x). 



(1) 



In an optical system, this is the quadrature-phase repre- 
sentation, which can be measured via optical homodyne 
detection |15| . 

For x = (Xi, . . . , Xk) T a vector from the fc-dimensional 
vector space M. k for the canonical positions of k players, 
the dealer implements a particular linear mapping 
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x h^ L(x) = (xi,Li(x), 
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The linear mapping L is constrained by the requirement 
(which can always be satisfied M) that the components of 
any fc-element subset of {x\, L±, . . . , L2fc-i} are linearly 
independent. The mapping L is used by the dealer to 
encode ip into the entangled state 



1$) 



$(xi) |Li(x))i ' ' ' |£ 2 fc-i(x)) 2fc -id fc x (3) 



(which is not normalizable for the same reason that \x) 
is not normalizable). 

The encoding (||) enables ip to be reconstructed from 
any k shares as follows. Let (r\, . . . ,r2k-i) be an arbi- 
trary permutation of indices (1, 2, . . . , 2fc — 1). As both 
sets {L ri , L r21 . . . , L rk } and {xi, L%, . . . , L2k-i} are lin- 
early independent, there exists a non-singular k x k ma- 
trix T such that 
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(4) 
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Given T, there exists a unitary operator U(T) such that 

U(T)\L ri ) ri \L r2 } r2 ■ ■ ■ \L Tk ) rk 



| T ||l/2 



Xl, 



ri\Lr k+1 ) 



■\L r 



(5) 



with ||T|| = |dctT|. The matrix elements of U in the 
continuous basis 



{|x') = K> ri -H4>rJ 



»=i S=i 

with {Tij} the matrix elements of T. 



(6) 



(7) 



The collaborators with shares indexed by n , r%, . . . , ru 
reconstruct the secret by transforming their shares via U, 
which results in the total state of all shares 

Um=J\\T\\^ f V(*i)Mn 



X \^r k + 1 )r 2 ' ' ' \^ J r 2k -i)r k \^r k + 1 )r k + 1 ' ' ' \^r 2k -i )r 2k -i 
X d.TidL rfc + 1 •••dL r2fc _ 1 

= j||T|| 1 /2| V , )r , i |e) r2rfc+i |e) r3!? . fc+2 ...|e )rfc!r , 2fc _ i (8) 

with J the Jacobian for the transformation from x to 
(xx,L rk+1 , . . . ,L r2k _ 1 ) and 



l©)< 



\x)i\x)jdx. 



(9) 



Equation (pi) shows that the ri th share is the secret state 
ip and shares r2, • • • , rk are maximally entangled with the 
shares of the adversaries (see Fig. [TJ). Thus the quantum 
secret is reconstructed from any k shares via a unitary 
transformation, and any k — 1 shares produces no infor- 
mation about ip whatsoever as tracing over the remaining 
k shares yields a multiple of the identity operator. 

Important components of the state (ph are the (un- 
normalized and ideal) EPR states |ll| \&)ij (see Eq. (g)) 
such that ij (x x'\Q)ij = S(x-x'). These states can be ap- 
proximated by the strongly squeezed two-mode vacuum 
states EtJ \rf)ij that have the representation 

OO 

iiixx'Wij = (1-V 2 ) 1/2 ZZ V n u n (x)u n (x') (10) 

n=a 

for — 1 < 77 < 1 and u n (x) = (x\n) with \n) the Fock 

state. As 



^ u n (x)u n (x') = S(x - x'), 



(11) 



n=0 



it holds 



lim(l - r] 2 )- 1/2 (xx'\r]) = 6(x - x) (12) 

»7->l 



and hence 1 77 — > 1) = |0). The share i of 1 77)17, after 
tracing over the share j, behaves locally as a thermal 
state qt with temperature T = — tko/{2kB^&\ri\), where 
ks denotes the Boltzmann constant; the limit 77 — > 1 
corresponds to T — ► 00. 



III. EXPERIMENTAL REALIZATION 

Now we show how to implement the above reconstruc- 
tion procedure experimentally. Given T in Eq. (^), there 
exists S € Sp(2fc,R) corresponding to T mapping the 
canonical position and (T T )~ 1 mapping the correspond- 
ing canonical momenta, for T the transpose. The sym- 
plectic transformation S can be decomposed into a se- 
quence of SU(2) and SU(1,1) transformations E3 that 



perform passive and active (squeezing) operations on the 
shares. Physically, such transformations can be real- 
ized by the combined SU(2) and SU(1,1) interferometry 
JL9| that uses beam splitters, mirrors, phase shifters and 
squeezers. The secret and shares are then distinct spatial 
modes of light, and an interferometer can be designed by 
any group of k collaborators to yield the secret at one 
output port when the shares are injected to the input 
ports. 

The encoding of the secret by the dealer can also be 
performed via (active) interferometry (again a symplectic 
transformation). For a chosen permutation of indices, 
the dealer creates the state (j|) and employing a suitable 
interferometer applies U* to this state in order to obtain 
<F In summary, the dealer can encode the secret state 
ip in a 2k — 1 mode entangled state $ via interferometry 
which can be decoded by any k collaborators also by 
interferometry. As has been mentioned at the start, the 
general (k, n) threshold scheme can be achieved by having 
the dealer discard 2k — 1 — n shares. 



A surprisingly simple (2,2) quantum secret sharing 
threshold scheme can be derived from the previous (2,3) 
scheme by discarding the third share. The (unnormal- 
ized) reduced density operator of the first two shares after 
tracing over the last share is 



P12 



= tf(\il>)i{il>\®t%)U, 



(17) 



for U the unitary operator induced by Ti 2 according to 
Eqs. (W) and (fjp, and 1 the unit operator. As the thermal 
state qt^oo is a multiple of the unit operator, the state 
of the two shares can be also obtained by mixing the 
secret tp with a thermal state of infinite temperature on 
a 50/50 BS (see Fig. ||). The encoding of the secret is 
thus performed by simply mixing it with a thermal state 
on a BS, whereas the reconstruction is accomplished via 
recombining the two shares on another 50/50 BS. As a 
result, the players obtain the secret state as well as the 
thermal state from the two BS output ports. 



V. THE CASE OF FINITE SQUEEZING 



IV. EXAMPLE: (2,3) THRESHOLD SCHEME 

We will give an example of the (2, 3) threshold scheme. 
The dealer chooses 



X 2 + Xl X-i-Xx 

i-i\ — 7= — , 1^2 



V2 ' 



V2 ' 



X2, 



(13) 



and constructs the corresponding interferometer with a 
50/50 beam splitter (BS) as shown in Fig. @ (a). This 
interferometer transforms the initial state |'0)i|0)23 to 
the three-mode entangled state 



|$) = / V(zi) 



x 2 + Xl 



V2 



x 2 - Xl 



V2 



\x 2 ) 3 dxi dx 2 . 
(14) 



The secret can then be reconstructed from any two 
shares. By combining shares 1 and 2 on a 50/50 BS 
(Fig. g (b)), thereby transforming the canonical positions 
of the two shares via 



*•-* 



1 -1 
1 1 



(15) 



the first share is left in the secret state ip. Similarly by 
combining the first and third shares on a non-degenerate 
parametric down-conversion crystal, pumped by a coher- 
ent field (see Fig. g (c)), that transforms the canonical 
positions via 



T, 



13 



V2 -1\ 
-1 V2j 



(16) 



the first share is left in the secret state -0- A similar pro- 
cedure can be employed for shares 2 and 3 to reconstruct 
the secret. 



Whereas infinite temperature is necessary for ideal 
(2, 2) quantum secret sharing threshold scheme, qt^oo 
contains on average an infinite number of photons so 
any finite error in the encoding or reconstruction pro- 
cess will produce infinitely many photons from output 
port 1 of the BS and thereby destroy the secret com- 
pletely. Therefore a finite-temperature qt must be em- 
ployed instead, and in the general case of (k,n) thresh- 
old scheme, finitely squeezed two-mode vacuum states 
must replace EPR states for the same reason. This will 
generally compromise the secret sharing fidelity, i.e., the 
overlap of the reconstructed state and the original secret 
state 



^ =<##>> 



(18) 



where p is the (generally mixed) state obtained as the 
result of reconstruction. Consider a dealer using an in- 
terferometer as in Fig. g (a) for the encoding process, 
where a two- mode squeezed vacuum state \rj = tanhr) 
replaces the EPR state at the two inputs. Clearly, play- 
ers 1 and 2 can still reconstruct the secret perfectly while 
players 1 and 3 or players 2 and 3 cannot. If the secret 
is a coherent state, the fidelity for players 1 and 3 is 



T - 



1 



1 



V 



1 



-2r 



(19) 



(see Fig. |). If r 
still achieve T = 1/2. 



(no squeezing), the players can 
This fidelity threshold can be used 
to verify whether a genuine quantum secret sharing has 
taken place in this particular (2, 3) threshold scheme. 



VI. CONCLUSION 

To conclude, we have developed a theory of quan- 
tum secret sharing using CV and shown how encoding 



and reconstruction processes could be achieved via (ac- 
tive) multimode interferometry for the (k,n) threshold 
scheme. The (2,3) and (2,2) schemes have been pre- 
sented in detail, including an allowance for finite squeez- 
ing and a minimum fidelity necessary to demonstrate that 
genuine secret sharing has been performed. The (2, 2) 
threshold scheme is achievable with current technology. 
The (fc, n) threshold scheme is readily generalized to 
an arbitrary adversary structure A by analogy with the 
discrete-variable schemes based on monotone span pro- 
grams 0J . For any adversary structure A, there exists a 
self-dual structure A' (A' is self-dual iff, for any division 
of the set of all players into two disjoint groups, exactly 
one group is able to reconstruct the secret), from which 
A can be obtained by discarding some shares || . For the 
self-dual adversary structure A', the encoding procedure 



of the dealer and decoding procedures of the collaborat- 
ing players can again be realized by linear mappings of 
the canonical positions by employing a suitable interfer- 
ometer. For a total of n players, the initial state of the 
dealer consists of the secret tp and n — 1 single-mode in- 
finitely squeezed vacuum states [|9| . 
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FIG. 1: The reconstruction of the secret for k — 4 corre- 
sponding to the permutation (n) = (2136475). In order to 
reconstruct the secret tf), the players 2, 1, 3 and 6 perform the 
unitary operation U from Eq. (J5[) on their shares. This results 
in the second share left in the state ip, while the shares 1, 3, 
and 6 form EPR states with the shares 4, 7 and 5, respectively. 
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FIG. 2: Encoding and reconstruction procedures for a (2, 3) 
threshold scheme, (a) For the encoding process, the dealer 
creates the state |V>)i|©)23 and combines modes 1 and 2 on a 
50/50 BS; (b) Players 1 and 2 combine their shares on a 50/50 
BS to obtain ip at one output; (c) players 1 and 3 combine 
their shares at a non-degenerate parametric down-converter 
which is pumped by a coherent beam of doubled frequency 
to obtain i\> at one output. In both cases (a) and (b) the 
remaining output forms an EPR state with the share of the 
adversary. 
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FIG. 3: The (2, 2) threshold scheme: the dealer encodes the 
secret by combining it with a thermal state of an infinite tem- 
prerature on a 50/50 BS. The two players can then reconstruct 
the secret by combining their beams on another 50/50 BS. 




FIG. 4: The fidelity T = (ip\p\lp) for the scheme in 
Fig. g (a), (c) with squeezing parameter r used by the dealer 
and the secret ip a coherent state. 



